In engine control units of internal combustion engine (gasoline and diesel), the torque-determining injections are controlled by a microcontroller as a processing unit. Via its output ports, this microcontroller controls a downstream control circuit, in particular in the form of an application-specific integrated circuit (ASIC) having output stages (so-called injector output stage module), which in turn controls the injectors, i.e., usually connected in a defined manner to an energy or voltage source. Convention controls of injectors and suitable control circuits are described in, for example, German Patent Application No. DE 100 22 956 A1.
Injection systems are included in the safety-relevant systems, for which a safety concept is advantageous. This safety concept may, for example, be represented using a multi-level concept. In the case of safety-critical functional units in vehicles, for example, electronic throttle control systems (EGAS), a so-called three-level concept may be used, for example, in the operating control unit. Of essential importance is a mutual monitoring within the control unit between the function calculator (central processing unit, CPU) and a separate monitoring module (UM or watchdog). The function calculator and the monitoring module communicate via a question-and-answer communication and, in the case of error, may switch off power output stages in the control unit, which are provided for the operation of the functional unit and consequently ensure the safety of the vehicle. In present electronic throttle control systems, the entire function and monitoring software is located in a control unit, as is described in German Patent No. DE 44 38 714 A1.
To ensure safety, it should be possible in a case of error, for example, when the processing unit is defective, to transfer the injection system into a safe state via redundant disconnecting paths. In the case of error, for example, the monitoring module is able to deactivate the injection output stage module via a disable pin, as a result of which all individual injection output stages are deactivated within it with the aid of an internal logic, in order to shut down the injectors. In diesel systems, for example, the pressure control valve may be used as a redundant path. If it is open, it is not possible to inject any fuel under pressure. However, this method is not always applicable, since this component is not always installed.
The disconnecting paths should also generally be checked for their proper functioning at least once per driving cycle.
However, this is very complex in the case of most of the known disconnecting paths.